/*
        httpda.c

        gSOAP HTTP Digest Authentication plugin.
        Adds support for digest authentication RFC2617 and the RFC7616 draft.

gSOAP XML Web services tools
Copyright (C) 2000-2016, Robert van Engelen, Genivia Inc., All Rights Reserved.
This part of the software is released under one of the following licenses:
GPL, the gSOAP public license, or Genivia's license for commercial use.
--------------------------------------------------------------------------------
gSOAP public license.

The contents of this file are subject to the gSOAP Public License Version 1.3
(the "License"); you may not use this file except in compliance with the
License. You may obtain a copy of the License at
http://www.cs.fsu.edu/~engelen/soaplicense.html
Software distributed under the License is distributed on an "AS IS" basis,
WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
for the specific language governing rights and limitations under the License.

The Initial Developer of the Original Code is Robert A. van Engelen.
Copyright (C) 2000-2016, Robert van Engelen, Genivia, Inc., All Rights Reserved.
--------------------------------------------------------------------------------
GPL license.

This program is free software; you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by the Free Software
Foundation; either version 2 of the License, or (at your option) any later
version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with
this program; if not, write to the Free Software Foundation, Inc., 59 Temple
Place, Suite 330, Boston, MA 02111-1307 USA

Author contact information:
engelen@genivia.com / engelen@acm.org

This program is released under the GPL with the additional exemption that
compiling, linking, and/or using OpenSSL is allowed.
--------------------------------------------------------------------------------
A commercial use license is available from Genivia, Inc., contact@genivia.com
--------------------------------------------------------------------------------
*/

/**

@mainpage

- @ref httpda documents the http_da plugin for HTTP Digest Authentication.

*/

/**

@page httpda The HTTP-DA plugin

[TOC]

@section httpda_0 Introduction

The upgraded HTTP digest authentication plugin for gSOAP adds support
for the RFC7616 draft that is backwards compatible with RFC2617.  The new
plugin adds SHA-256 (and SHA-512/256 when OpenSSL supports it) algorithms,
including the -sess variants.  To maintain backwards compatibility with RFC2617
the MD5 algorithm is still supported but not recommended.

HTTP **digest authentication** does not transmit the user id and password for
authentication.  Instead, a server negotiates credentials (username and/or
password) with a client using cryptographic hashing algorithms with nonce
values to prevent replay attacks.

By contrast, HTTP **basic authentication** is not safe over unencrypted
channels because the password is transmitted to the server unencrypted.
Therefore, this mechanism provides no confidentiality protection for the
transmitted credentials.  HTTPS is typically preferred over or used in
conjunction with HTTP basic authentication.

To support HTTP digest authentication in favor of HTTP basic authentication,
you will need to install OpenSSL and follow these steps to build your projects:

- Compile your project that uses gSOAP source code with `-DWITH_OPENSSL`.
- Link libgsoapssl (libgsoapssl++), or use the `stdsoap2.c[pp]` source.
- Compile and link your code together with `plugin/httpda.c`, `plugin/smdevp.c`,
  and `plugin/threads.c`

The plugin is MT-safe by means of internal mutex locks.  Mutex ensures
exclusive access and updates of the shared session store with nonces to prevent
replay attacks.

@section httpda_1 Client-side usage

HTTP basic authentication is the default authentication mechanism supported by
gSOAP.  You can set the basic authentication credentials at the client-side
with:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~{.cpp}
    soap.userid = "<userid>";
    soap.passed = "<passwd>";
    if (soap_call_ns__method(&soap, ...))
      ... // error
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

HTTP basic authentication should **never** be used over plain HTTP, because the
credentials (the ID and password) are transmitted in the clear in base64
encoded form which is easily reversible.  This mechanism is safer to use over
HTTPS, because the HTTP headers and body are encrypted.

This upgraded HTTP digest authentication plugin supports RFC7616 and RFC2617.
RFC7616 adds SHA2 and is backwards compatible to clients that use MD5.  The MD5
algorithm is not allowed in FIPS making SHA-256 or SHA-512-256 digest
algorithms mandatory.  The client-side of the plugin handles both RFCs
automatically.

To use HTTP digest authentication with gSOAP, register the http_da plugin as
follows:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~{.cpp}
    #include "httpda.h"
    soap_register_plugin(&soap, http_da);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

To make a client-side service call you will need to create a digest store
`http_da_info`.  The store holds the digest information locally on your machine
to manage repeated authentication challenges from all servers you connect to.
Use `http_da_save()` to add credentials to the store and release the store with
`http_da_release()` when you no longer need the credentials.

The `http_da_info` store is intended for one thread to issue a sequence of
calls that are all authenticated without requiring (re)negotiation.  You should
not share the `http_da_info` store with multiple threads, unless you use mutex
locks.

Here is an example:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~{.cpp}
    struct http_da_info info;
    if (soap_call_ns__method(&soap, ...))
    {
      if (soap.error == 401) // HTTP authentication is required
      {
        http_da_save(&soap, &info, "<authrealm>", "<userid>", "<passwd>");
        if (soap_call_ns__method(&soap, ...)) // try again
          ... // error
        http_da_release(&soap, &info);
      }
      else
        ... // other error
    }
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The `"<authrealm>"` string is the protected realm of the server that requires
authorization.  This string can be obtained with the `soap.authrealm` string
after an unsuccessful non-authenticated call so you can use it to save
credentials to the digest store:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~{.cpp}
    if (soap_call_ns__method(&soap, ...))
    {
      if (soap.error == 401) // HTTP authentication is required
      {
        const char *realm = soap.authrealm;
        http_da_save(&soap, &info, realm, "<userid>", "<passwd>");
        ...
      }
      else
        ... // error
    }
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Before a second call is made to the same endpoint that requires authentication,
you must restore the authentication state with `http_da_restore()`, then use
it, and finally release it with `http_da_release()`:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~{.cpp}
    struct http_da_info info;
    bool auth = false;

    if (soap_call_ns__method(&soap, ...))
    {
      if (soap.error == 401) // HTTP authentication is required
      {
        http_da_save(&soap, &info, "<authrealm>", "<userid>", "<passwd>");
        auth = true;
      }
      else
        ... // other error
    }

    if (soap_call_ns__method(&soap, ...))
      ... // error

    if (auth)
      http_da_restore(&soap, &info);
    if (soap_call_ns__method(&soap, ...))
      ... // error

    soap_destroy(&soap); // okay to dealloc data
    soap_end(&soap);     // okay to dealloc data

    if (auth)
      http_da_restore(&soap, &info);
    if (soap_call_ns__method(&soap, ...))
      ... // error

    if (auth)
      http_da_release(&soap, &info);

    soap_destroy(&soap);
    soap_end(&soap);
    soap_done(&soap);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

For HTTP proxies requiring HTTP digest authenticaiton, use the 'proxy'
functions of the plugin:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~{.cpp}
    struct http_da_info info;
    ...
    if (soap_call_ns__method(&soap, ...))
    {
      if (soap.error == 407) // HTTP proxy authentication is required
      {
        http_da_proxy_save(&soap, &info, "<authrealm>", "<userid>", "<passwd>");
        auth = true;
      }
      else
        ... // error
    }

    if (auth)
      http_da_proxy_restore(&soap, &info);
    if (soap_call_ns__method(&soap, ...))
      ... // error

    http_da_proxy_release(&soap, &info);

    soap_destroy(&soap);
    soap_end(&soap);
    soap_done(&soap);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

@section httpda_2 Client example

A client authenticating against a server:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~{.cpp}
    soap_register_plugin(&soap, http_da);
    // try calling without authenticating
    if (soap_call_ns__method(&soap, ...))
    {
      if (soap.error == 401) // HTTP authentication is required
      {
        if (!strcmp(soap.authrealm, authrealm)) // check authentication realm
        {
          struct http_da_info info; // to store userid and passwd
          http_da_save(&soap, &info, authrealm, userid, passwd);
          // call again, now with credentials
          if (soap_call_ns__method(&soap, ...) == SOAP_OK)
          {
            ... // process response data
            soap_end(&soap);
            ... // userid and passwd were deallocated (!)
            http_da_restore(&soap, &info); // get userid and passwd after soap_end()
            if (!soap_call_ns__method(&soap, ...) == SOAP_OK)
              ... // error
            http_da_release(&soap, &info); // free data and remove userid and passwd
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

A client authenticating against a proxy:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~{.cpp}
    soap_register_plugin(&soap, http_da);
    // try calling without authenticating
    if (soap_call_ns__method(&soap, ...))
    {
      if (soap.error == 407) // HTTP authentication is required
      {
        if (!strcmp(soap.authrealm, authrealm)) // check authentication realm
        {
          struct http_da_info info; // to store userid and passwd
          http_da_proxy_save(&soap, &info, authrealm, userid, passwd);
          // call again, now with credentials
          if (soap_call_ns__method(&soap, ...) == SOAP_OK)
          {
            ... // process response data
            soap_end(&soap);
            ... // userid and passwd were deallocated (!)
            http_da_proxy_restore(&soap, &info); // get userid and passwd after soap_end()
            if (!soap_call_ns__method(&soap, ...) == SOAP_OK)
              ... // error
            http_da_proxy_release(&soap, &info); // free data and remove userid and passwd
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

@section httpda_3 Server-side usage

As explained in the gSOAP user guid, server-side HTTP basic authentication is
enforced by simply checking the `soap.userid` and `soap.passwd` values in a
service method that requires client authentication:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~{.cpp}
    soap_register_plugin(&soap, http_da);
    ...
    soap_serve(&soap);
    ...
    int ns__method(struct soap *soap, ...)
    {
      if (!soap->userid || !soap->passwd || strcmp(soap->userid, "<userid>") || strcmp(soap->passwd, "<passwd>"))
        return 401; // HTTP authentication required
      ...
    }
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

HTTP digest authentication is verified differently, because digests are
compared, not passwords:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~{.cpp}
    soap_register_plugin(&soap, http_da);
    ...
    soap_serve(&soap);
    ...
    int ns__method(struct soap *soap, ...)
    {
      if (soap->authrealm && soap->userid)
      {
        passwd = ... // database lookup on userid and authrealm to find passwd
        if (!strcmp(soap->authrealm, authrealm) && !strcmp(soap->userid, userid))
        { 
          if (!http_da_verify_post(soap, passwd)) // HTTP POST DA verification
          {
            ... // process request and produce response
            return SOAP_OK;
          }
        }
      }
      soap->authrealm = authrealm; // realm to send to client
      return 401; // Not authorized, challenge with digest authentication
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The `http_da_verify_post()` function checks the HTTP POST credentials by
computing and comparing a digest of the password.  To verify an HTTP GET
operation, use `http_da_verify_get()` instead.

RFC7616 recommends SHA2 over MD5.  The MD5 algorithm is not allowed in FIPS and
SHA-256 or SHA-512-256 are mandatory.  The upgrade plugin uses SHA-256 as the
default algorithm and reverts to MD5 only if required by a client that does not
support RFC7616.

The default SHA-256 digest algorithm is enabled automatically.  However, at the
server side you can also use a plugin registry option to set a different
algorithm as the default:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~{.cpp}
    soap_register_plugin_arg(&soap, http_da, <option>);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

where `<option>` is one of:

- `http_da_md5()` MD5 (not recommended).
- `http_da_md5_sess()` MD5-sess (not recommended).
- `http_da_sha256()` SHA-256 (recommended).
- `http_da_sha256_sess()` SHA-256-sess (recommended).
- `http_da_sha512_256()` SHA-512-256 (not yet supported).
- `http_da_sha512_256_sess()` SHA-512-256-sess (not yet supported).

When non-MD5 option is selected, the server will present that digest algorithm
together with the MD5 authentication algorithm as challenge to the client.  If
the client is upgraded to RFC7616 it selects the newer protcol.  If the client
is not upgraded it will select the older MD5-based protocol.

To revert to RFC2617 use `http_da_md5()`.

@section httpda_4 Server example

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~{.cpp}
    soap_register_plugin(&soap, http_da);
    ...
    soap_serve(&soap);
    ...
    int ns__method(struct soap *soap, ...)
    {
      if (soap->userid && soap->passwd) // Basic authentication
      {
        if (!strcmp(soap->userid, userid) && !strcmp(soap->passwd, passwd))
        {
          ... // can also check soap->authrealm 
          ... // process request and produce response
          return SOAP_OK;
        }
      }
      else if (soap->authrealm && soap->userid) // Digest authentication
      {
        passwd = ... // database lookup on userid and authrealm to find passwd
        if (!strcmp(soap->authrealm, authrealm) && !strcmp(soap->userid, userid))
        { 
          if (!http_da_verify_post(soap, passwd)) // HTTP POST DA verification
          {
            ... // process request and produce response
            return SOAP_OK;
          }
        }
      }
      soap->authrealm = authrealm; // realm to send to client
      return 401; // Not authorized, challenge with digest authentication
    }
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

@section httpda_5 Limitations

HTTP digest authentication cannot be used with streaming MTOM/MIME/DIME
attachments.  Non-streaming MTOM/MIME/DIME attachments are handled just fine.
MTOM/MIM/DIME attachment streaming is automatically turned off by the plugin
and attachment data is buffered rather than streamed.  

*/

#include "httpda.h"

#ifdef __cplusplus
extern "C" {
#endif

const char http_da_id[] = HTTP_DA_ID;

/** HTTP DA session database */
static struct http_da_session *http_da_session = NULL;

/** HTTP DA session database lock */
static MUTEX_TYPE http_da_session_lock = MUTEX_INITIALIZER;

#define HTTP_DA_NONCELEN (21)
#define HTTP_DA_OPAQUELEN (9)

/******************************************************************************\
 *
 *      Forward decls
 *
\******************************************************************************/

static int http_da_init(struct soap *soap, struct http_da_data *data, int *arg);
static int http_da_copy(struct soap *soap, struct soap_plugin *dst, struct soap_plugin *src);
static void http_da_delete(struct soap *soap, struct soap_plugin *p);

static int http_da_post_header(struct soap *soap, const char *key, const char *val);
static int http_da_parse(struct soap *soap);
static int http_da_parse_header(struct soap *soap, const char *key, const char *val);
static int http_da_prepareinitsend(struct soap *soap);
static int http_da_prepareinitrecv(struct soap *soap);
static int http_da_preparesend(struct soap *soap, const char *buf, size_t len);
static int http_da_preparerecv(struct soap *soap, const char *buf, size_t len);
static int http_da_preparefinalrecv(struct soap *soap);

static int http_da_verify_method(struct soap *soap, const char *method, const char *passwd);
static void http_da_session_start(const char *realm, const char *nonce, const char *opaque);
static int http_da_session_update(const char *realm, const char *nonce, const char *opaque, const char *cnonce, const char *ncount);
static void http_da_session_cleanup();

static void http_da_calc_nonce(struct soap *soap, char nonce[HTTP_DA_NONCELEN]);
static void http_da_calc_opaque(struct soap *soap, char opaque[HTTP_DA_OPAQUELEN]);
static int http_da_calc_HA1(struct soap *soap, struct soap_smd_data *smd_data, const char *alg, const char *userid, const char *realm, const char *passwd, const char *nonce, const char *cnonce, char HA1hex[65]);
static int http_da_calc_response(struct soap *soap, struct soap_smd_data *smd_data, const char *alg, char HA1hex[65], const char *nonce, const char *ncount, const char *cnonce, const char *qop, const char *method, const char *uri, char entityHAhex[65], char response[65], char responseHA[32]);

/******************************************************************************\
 *
 *      Plugin registry
 *
\******************************************************************************/

SOAP_FMAC1
int
SOAP_FMAC2
http_da(struct soap *soap, struct soap_plugin *p, void *arg)
{
  (void)arg;
  p->id = http_da_id;
  p->data = (void*)SOAP_MALLOC(soap, sizeof(struct http_da_data));
  p->fcopy = http_da_copy;
  p->fdelete = http_da_delete;
  if (p->data)
  {
    if (http_da_init(soap, (struct http_da_data*)p->data, (int*)arg))
    {
      SOAP_FREE(soap, p->data);
      return SOAP_EOM;
    }
  }
  return SOAP_OK;
}

/******************************************************************************/

static int
http_da_init(struct soap *soap, struct http_da_data *data, int *arg)
{
  data->fposthdr = soap->fposthdr;
  soap->fposthdr = http_da_post_header;
  data->fparse = soap->fparse;
  soap->fparse = http_da_parse;
  data->fparsehdr = soap->fparsehdr;
  soap->fparsehdr = http_da_parse_header;
  data->fprepareinitsend = soap->fprepareinitsend;
  soap->fprepareinitsend = http_da_prepareinitsend;
  data->fprepareinitrecv = soap->fprepareinitrecv;
  soap->fprepareinitrecv = http_da_prepareinitrecv;
  if (arg && *arg >= 0 && *arg <= 5)
    data->option = *arg;
  else
    data->option = 2; /* SHA-256 by default */
  data->smd_data.ctx = NULL;
  memset((void*)data->digest, 0, sizeof(data->digest));
  data->nonce = NULL;
  data->opaque = NULL;
  data->qop = NULL;
  data->alg = NULL;
  data->nc = 0;
  data->ncount = NULL;
  data->cnonce = NULL;
  memset((void*)data->response, 0, sizeof(data->response));

  return SOAP_OK;
}

/******************************************************************************/

static int
http_da_copy(struct soap *soap, struct soap_plugin *dst, struct soap_plugin *src)
{
  (void)soap;
  dst->data = (void*)SOAP_MALLOC(soap, sizeof(struct http_da_data));
  soap_memcpy((void*)dst->data, sizeof(struct http_da_data), (const void*)src->data, sizeof(struct http_da_data));
  ((struct http_da_data*)dst->data)->smd_data.ctx = NULL;
  memset((void*)((struct http_da_data*)dst->data)->digest, 0, sizeof(((struct http_da_data*)dst->data)->digest));
  ((struct http_da_data*)dst->data)->nonce = NULL;
  ((struct http_da_data*)dst->data)->opaque = NULL;
  ((struct http_da_data*)dst->data)->qop = NULL;
  ((struct http_da_data*)dst->data)->alg = NULL;
  ((struct http_da_data*)dst->data)->nc = 0;
  ((struct http_da_data*)dst->data)->ncount = NULL;
  ((struct http_da_data*)dst->data)->cnonce = NULL;
  memset((void*)((struct http_da_data*)dst->data)->response, 0, sizeof(((struct http_da_data*)dst->data)->response));
  return SOAP_OK;
}

/******************************************************************************/

static void
http_da_delete(struct soap *soap, struct soap_plugin *p)
{
  if (((struct http_da_data*)p->data)->smd_data.ctx)
    soap_smd_final(soap, &((struct http_da_data*)p->data)->smd_data, NULL, NULL);
  if (p->data)
    SOAP_FREE(soap, p->data);
}

/******************************************************************************\
 *
 *      Plugin registry options
 *
\******************************************************************************/

/**
@brief Use soap_register_plugin_arg(soap, http_da, http_da_md5()) for MD5 server-side challenge algorithm (not recommended).
*/
SOAP_FMAC1
void *
SOAP_FMAC2
http_da_md5()
{
  static int option = 0;
  return (void*)&option;
}

/******************************************************************************/

/**
@brief Use soap_register_plugin_arg(soap, http_da, http_da_md5_sess()) for MD5-sess server-side challenge algorithm (not recommended).
*/
SOAP_FMAC1
void *
SOAP_FMAC2
http_da_md5_sess()
{
  static int option = 1;
  return (void*)&option;
}

/******************************************************************************/

/**
@brief Use soap_register_plugin_arg(soap, http_da, http_da_sha256()) for MD5 server-side challenge algorithm (recommended).
*/
SOAP_FMAC1
void *
SOAP_FMAC2
http_da_sha256()
{
  static int option = 2;
  return (void*)&option;
}

/******************************************************************************/

/**
@brief Use soap_register_plugin_arg(soap, http_da, http_da_sha256_sess()) for MD5-sess server-side challenge algorithm (recommended).
*/
SOAP_FMAC1
void *
SOAP_FMAC2
http_da_sha256_sess()
{
  static int option = 3;
  return (void*)&option;
}

/******************************************************************************/

/**
@brief Use soap_register_plugin_arg(soap, http_da, http_da_sha512_256()) for MD5 server-side challenge algorithm (not yet supported).
*/
SOAP_FMAC1
void *
SOAP_FMAC2
http_da_sha512_256()
{
  static int option = 4;
  return (void*)&option;
}

/******************************************************************************/

/**
@brief Use soap_register_plugin_arg(soap, http_da, http_da_sha512_256_sess()) for MD5-sess server-side challenge algorithm (not yet supported).
*/
SOAP_FMAC1
void *
SOAP_FMAC2
http_da_sha512_256_sess()
{
  static int option = 5;
  return (void*)&option;
}

/******************************************************************************\
 *
 *      Callbacks
 *
\******************************************************************************/

static int
http_da_post_header(struct soap *soap, const char *key, const char *val)
{
  struct http_da_data *data = (struct http_da_data*)soap_lookup_plugin(soap, http_da_id);

  if (!data)
    return SOAP_PLUGIN_ERROR;

  /* client's HTTP Authorization request */
  if (key && (!strcmp(key, "Authorization") || !strcmp(key, "Proxy-Authorization")))
  {
    char HA1hex[65], entityHAhex[65], response[65], responseHA[32];
    char cnonce[HTTP_DA_NONCELEN];
    char ncount[9];
    const char *qop, *method;
    const char *userid = (*key == 'A' ? soap->userid : soap->proxy_userid);
    const char *passwd = (*key == 'A' ? soap->passwd : soap->proxy_passwd);
    size_t smd_len = 16;

    if (data->alg && !soap_tag_cmp(data->alg, "SHA-256*"))
      smd_len = 32;

    if (soap_smd_final(soap, &data->smd_data, data->digest, NULL))
      return soap->error;

    if (!userid || !passwd || !soap->authrealm || !data->nonce)
    {
#ifdef SOAP_DEBUG
      fprintf(stderr, "Debug message: authentication header construction failed, missing parts of the authentication data!\n");
#endif
      return SOAP_OK;
    }

    http_da_calc_nonce(soap, cnonce);

    if (http_da_calc_HA1(soap, &data->smd_data, data->alg, userid, soap->authrealm, passwd, data->nonce, cnonce, HA1hex))
      return soap->error;

    if (soap->status != SOAP_GET && soap->status != SOAP_CONNECT && data->qop && !soap_tag_cmp(data->qop, "*auth-int*"))
    {
      qop = "auth-int";
      (void)soap_s2hex(soap, (unsigned char*)data->digest, entityHAhex, smd_len);
    }
    else if (data->qop)
      qop = "auth";
    else
      qop = NULL;

    if (soap->status == SOAP_GET)
      method = "GET";
    else if (soap->status == SOAP_CONNECT)
      method = "CONNECT";
    else
      method = "POST";

    (SOAP_SNPRINTF(ncount, sizeof(ncount), 8), "%8.8lx", data->nc++);

    if (http_da_calc_response(soap, &data->smd_data, data->alg, HA1hex, data->nonce, ncount, cnonce, qop, method, soap->path, entityHAhex, response, responseHA))
      return soap->error;

    (SOAP_SNPRINTF(soap->tmpbuf, sizeof(soap->tmpbuf), strlen(soap->authrealm) + strlen(userid) + strlen(data->nonce) + strlen(soap->path) + strlen(ncount) + strlen(cnonce) + strlen(response) + 75), "Digest algorithm=%s, realm=\"%s\", username=\"%s\", nonce=\"%s\", uri=\"%s\", nc=%s, cnonce=\"%s\", response=\"%s\"", data->alg ? data->alg : "MD5", soap->authrealm, userid, data->nonce, soap->path, ncount, cnonce, response);

    if (data->opaque)
    {
      size_t l = strlen(soap->tmpbuf);
      (SOAP_SNPRINTF(soap->tmpbuf + l, sizeof(soap->tmpbuf) - l, strlen(data->opaque) + 11), ", opaque=\"%s\"", data->opaque);
    }

    if (qop)
    {
      size_t l = strlen(soap->tmpbuf);
      (SOAP_SNPRINTF(soap->tmpbuf + l, sizeof(soap->tmpbuf) - l, strlen(qop) + 8), ", qop=\"%s\"", qop);
    }

    return data->fposthdr(soap, key, soap->tmpbuf);
  }

  /* server's HTTP Authorization challenge/response */
  if (key && (!strcmp(key, "WWW-Authenticate") || !strcmp(key, "Proxy-Authenticate")))
  {
    static const char *algos[] = { "MD5", "MD5-sess", "SHA-256", "SHA-256-sess", "SHA-512-256", "SHA-512-256-sess" };
    const char *alg = algos[data->option];
    char nonce[HTTP_DA_NONCELEN];
    char opaque[HTTP_DA_OPAQUELEN];

    http_da_calc_nonce(soap, nonce);
    http_da_calc_opaque(soap, opaque);

    http_da_session_start(soap->authrealm, nonce, opaque);

    if (data->option > 0)
    {
      (SOAP_SNPRINTF(soap->tmpbuf, sizeof(soap->tmpbuf), strlen(soap->authrealm) + strlen(nonce) + strlen(opaque) + 59), "Digest algorithm=%s, realm=\"%s\", qop=\"auth,auth-int\", nonce=\"%s\", opaque=\"%s\"", alg, soap->authrealm, nonce, opaque);
      if (data->fposthdr(soap, key, soap->tmpbuf))
        return soap->error;
    }
    (SOAP_SNPRINTF(soap->tmpbuf, sizeof(soap->tmpbuf), strlen(soap->authrealm) + strlen(nonce) + strlen(opaque) + 59), "Digest algorithm=MD5, realm=\"%s\", qop=\"auth,auth-int\", nonce=\"%s\", opaque=\"%s\"", soap->authrealm, nonce, opaque);
    return data->fposthdr(soap, key, soap->tmpbuf);
  }

  return data->fposthdr(soap, key, val);
}

/******************************************************************************/

static int
http_da_parse(struct soap *soap)
{ 
  struct http_da_data *data = (struct http_da_data*)soap_lookup_plugin(soap, http_da_id);

  if (!data)
    return SOAP_PLUGIN_ERROR;

  data->qop = NULL;

  /* HTTP GET w/o body with qop=auth-int still requires a digest */
  if (soap_smd_init(soap, &data->smd_data, SOAP_SMD_DGST_MD5, NULL, 0)
   || soap_smd_final(soap, &data->smd_data, data->digest, NULL))
    return soap->error;

  soap->error = data->fparse(soap);
  if (soap->error)
    return soap->error;

  if (data->qop && !soap_tag_cmp(data->qop, "auth-int"))
  {
    if (soap->fpreparerecv != http_da_preparerecv)
    {
      data->fpreparerecv = soap->fpreparerecv;
      soap->fpreparerecv = http_da_preparerecv;
    }
    if (soap->fpreparefinalrecv != http_da_preparefinalrecv)
    {
      data->fpreparefinalrecv = soap->fpreparefinalrecv;
      soap->fpreparefinalrecv = http_da_preparefinalrecv;
    }
    if (soap_smd_init(soap, &data->smd_data, SOAP_SMD_DGST_MD5, NULL, 0))
      return soap->error;
  }
 
  return SOAP_OK;
}

/******************************************************************************/

static int
http_da_parse_header(struct soap *soap, const char *key, const char *val)
{
  struct http_da_data *data = (struct http_da_data*)soap_lookup_plugin(soap, http_da_id);

  if (!data)
    return SOAP_PLUGIN_ERROR;

  /* check if server received Authorization Digest HTTP header from client */
  if (!soap_tag_cmp(key, "Authorization") && !soap_tag_cmp(val, "Digest *"))
  {
    data->alg = soap_strdup(soap, soap_get_header_attribute(soap, val + 7, "algorithm"));
    soap->authrealm = soap_strdup(soap, soap_get_header_attribute(soap, val + 7, "realm"));
    soap->userid = soap_strdup(soap, soap_get_header_attribute(soap, val + 7, "username"));
    soap->passwd = NULL;
    data->nonce = soap_strdup(soap, soap_get_header_attribute(soap, val + 7, "nonce"));
    data->opaque = soap_strdup(soap, soap_get_header_attribute(soap, val + 7, "opaque"));
    data->qop = soap_strdup(soap, soap_get_header_attribute(soap, val + 7, "qop"));
    data->ncount = soap_strdup(soap, soap_get_header_attribute(soap, val + 7, "nc"));
    data->cnonce = soap_strdup(soap, soap_get_header_attribute(soap, val + 7, "cnonce"));
    (void)soap_hex2s(soap, soap_get_header_attribute(soap, val + 7, "response"), data->response, 32, NULL);
    return SOAP_OK;
  }

  /* check if client received WWW-Authenticate Digest HTTP header from server */
  if ((!soap_tag_cmp(key, "WWW-Authenticate") || !soap_tag_cmp(key, "Proxy-Authenticate")) && !soap_tag_cmp(val, "Digest *"))
  {
    const char *authrealm = soap_get_header_attribute(soap, val + 7, "realm");
    if (authrealm && (!soap->authrealm || strcmp(authrealm, soap->authrealm)))
    {
      const char *alg;
      soap->authrealm = soap_strdup(soap, authrealm);
      alg = soap_get_header_attribute(soap, val + 7, "algorithm");
      if (!alg || soap_tag_cmp(alg, "SHA-512-256*"))
      {
        /* got the first authenticate header for this realm that we can accept */
        data->alg = soap_strdup(soap, alg);
        data->nonce = soap_strdup(soap, soap_get_header_attribute(soap, val + 7, "nonce"));
        data->opaque = soap_strdup(soap, soap_get_header_attribute(soap, val + 7, "opaque"));
        data->qop = soap_strdup(soap, soap_get_header_attribute(soap, val + 7, "qop"));
        data->nc = 1;
        data->ncount = NULL;
        data->cnonce = NULL;
      }
      else
      {
        soap->authrealm = NULL;
      }
    }
    return SOAP_OK;
  }

  return data->fparsehdr(soap, key, val);
}

/******************************************************************************/

static int
http_da_prepareinitsend(struct soap *soap)
{
  struct http_da_data *data = (struct http_da_data*)soap_lookup_plugin(soap, http_da_id);

  if (!data)
    return SOAP_PLUGIN_ERROR;

  if ((soap->mode & SOAP_IO) != SOAP_IO_STORE && (soap->mode & (SOAP_ENC_DIME | SOAP_ENC_MIME)))
  {
    /* support non-streaming MIME/DIME attachments by buffering the message */
    soap->omode &= ~SOAP_IO;
    soap->omode |= SOAP_IO_STORE;
    soap->mode &= ~SOAP_IO;
    soap->mode |= SOAP_IO_STORE;
  }
  else
  {
    if ((soap->userid && soap->passwd)
     || (soap->proxy_userid && soap->proxy_passwd))
    {
      if (soap_smd_init(soap, &data->smd_data, SOAP_SMD_DGST_MD5, NULL, 0))
        return soap->error;
      if (soap->fpreparesend != http_da_preparesend)
      {
        data->fpreparesend = soap->fpreparesend;
        soap->fpreparesend = http_da_preparesend;
      }
      if ((soap->mode & SOAP_IO) == SOAP_IO_CHUNK)
        soap->mode |= SOAP_IO_LENGTH;
    }
  }

  if (data->fprepareinitsend)
    return data->fprepareinitsend(soap);

  return SOAP_OK;
}

/******************************************************************************/

static int
http_da_prepareinitrecv(struct soap *soap)
{
  struct http_da_data *data = (struct http_da_data*)soap_lookup_plugin(soap, http_da_id);

  if (!data)
    return SOAP_PLUGIN_ERROR;

  if (soap->fpreparerecv == http_da_preparerecv)
    soap->fpreparerecv = data->fpreparerecv;
  if (soap->fpreparefinalrecv == http_da_preparefinalrecv)
    soap->fpreparefinalrecv = data->fpreparefinalrecv;

  if (data->fprepareinitrecv)
    return data->fprepareinitrecv(soap);

  return SOAP_OK;
}

/******************************************************************************/

static int
http_da_preparesend(struct soap *soap, const char *buf, size_t len)
{
  struct http_da_data *data = (struct http_da_data*)soap_lookup_plugin(soap, http_da_id);

  if (!data)
    return SOAP_PLUGIN_ERROR;

  if (soap_smd_update(soap, &data->smd_data, buf, len))
    return soap->error;

  if (data->fpreparesend)
    return data->fpreparesend(soap, buf, len);

  return SOAP_OK;
}

/******************************************************************************/

static int
http_da_preparerecv(struct soap *soap, const char *buf, size_t len)
{
  struct http_da_data *data = (struct http_da_data*)soap_lookup_plugin(soap, http_da_id);

  if (!data)
    return SOAP_PLUGIN_ERROR;

  if (soap_smd_update(soap, &data->smd_data, buf, len))
    return soap->error;

  if (data->fpreparerecv)
    return data->fpreparerecv(soap, buf, len);

  return SOAP_OK;
}

/******************************************************************************/

static int
http_da_preparefinalrecv(struct soap *soap)
{
  struct http_da_data *data = (struct http_da_data*)soap_lookup_plugin(soap, http_da_id);

  if (!data)
    return SOAP_PLUGIN_ERROR;

  if (soap_smd_final(soap, &data->smd_data, data->digest, NULL))
    return soap->error;

  soap->fpreparerecv = data->fpreparerecv;
  soap->fpreparefinalrecv = data->fpreparefinalrecv;

  if (soap->fpreparefinalrecv)
    return soap->fpreparefinalrecv(soap);

  return SOAP_OK;
}

/******************************************************************************\
 *
 *      Client-side digest authentication state management
 *
\******************************************************************************/

/**
@brief Saves the credentials to the digest store to use repeatedly for authentication.
@param soap context
@param info a pointer to the digest store
@param realm string (e.g. use soap->authrealm) of the server
@param userid the user ID string
@param passwd the user password string
*/
SOAP_FMAC1
void
SOAP_FMAC2
http_da_save(struct soap *soap, struct http_da_info *info, const char *realm, const char *userid, const char *passwd)
{
  struct http_da_data *data = (struct http_da_data*)soap_lookup_plugin(soap, http_da_id);
  if (!data)
    return;

  soap->authrealm = info->authrealm = soap_strdup(NULL, realm);
  info->userid = soap_strdup(NULL, userid);
  soap->userid = info->userid;
  info->passwd = soap_strdup(NULL, passwd);
  soap->passwd = info->passwd;
  info->nonce = soap_strdup(NULL, data->nonce);
  info->opaque = soap_strdup(NULL, data->opaque);
  info->qop = soap_strdup(NULL, data->qop);
  info->alg = soap_strdup(NULL, data->alg);
}

/******************************************************************************/

/**
@brief Saves the credentials to the digest store to use repeatedly for proxy authentication.
@param soap context
@param info a pointer to the digest store
@param realm string (e.g. use soap->authrealm) of the server
@param userid the user ID string
@param passwd the user password string
*/
SOAP_FMAC1
void
SOAP_FMAC2
http_da_proxy_save(struct soap *soap, struct http_da_info *info, const char *realm, const char *userid, const char *passwd)
{
  struct http_da_data *data = (struct http_da_data*)soap_lookup_plugin(soap, http_da_id);
  if (!data)
    return;

  soap->authrealm = info->authrealm = soap_strdup(NULL, realm);
  info->userid = soap_strdup(NULL, userid);
  soap->proxy_userid = info->userid;
  info->passwd = soap_strdup(NULL, passwd);
  soap->proxy_passwd = info->passwd;
  info->nonce = soap_strdup(NULL, data->nonce);
  info->opaque = soap_strdup(NULL, data->opaque);
  info->qop = soap_strdup(NULL, data->qop);
  info->alg = soap_strdup(NULL, data->alg);
}

/******************************************************************************/

/**
@brief Retrieves the credentials from the digest store to use for authentication.
@param soap context
@param info a pointer to the digest store
*/
SOAP_FMAC1
void
SOAP_FMAC2
http_da_restore(struct soap *soap, struct http_da_info *info)
{
  struct http_da_data *data = (struct http_da_data*)soap_lookup_plugin(soap, http_da_id);
  if (!data)
    return;
  soap->authrealm = info->authrealm;
  soap->userid = info->userid;
  soap->passwd = info->passwd;
  data->nonce = info->nonce;
  data->opaque = info->opaque;
  data->qop = info->qop;
  data->alg = info->alg;
}

/******************************************************************************/

/**
@brief Retrieves the credentials from the digest store to use for proxy authentication.
@param soap context
@param info a pointer to the digest store
*/
SOAP_FMAC1
void
SOAP_FMAC2
http_da_proxy_restore(struct soap *soap, struct http_da_info *info)
{
  struct http_da_data *data = (struct http_da_data*)soap_lookup_plugin(soap, http_da_id);
  if (!data)
    return;
  soap->authrealm = info->authrealm;
  soap->proxy_userid = info->userid;
  soap->proxy_passwd = info->passwd;
  data->nonce = info->nonce;
  data->opaque = info->opaque;
  data->qop = info->qop;
  data->alg = info->alg;
}

/******************************************************************************/

/**
@brief Releases the digest store and frees memory
@param soap context
@param info a pointer to the digest store
*/
SOAP_FMAC1
void
SOAP_FMAC2
http_da_release(struct soap *soap, struct http_da_info *info)
{
  struct http_da_data *data = (struct http_da_data*)soap_lookup_plugin(soap, http_da_id);
  if (!data)
    return;

  soap->authrealm = NULL;
  soap->userid = NULL;
  soap->passwd = NULL;

  data->nonce = NULL;
  data->opaque = NULL;
  data->qop = NULL;
  data->alg = NULL;

  if (info->authrealm)
  {
    free((void*)info->authrealm);
    info->authrealm = NULL;
  }
  if (info->userid)
  {
    free((void*)info->userid);
    info->userid = NULL;
  }
  if (info->passwd)
  {
    free((void*)info->passwd);
    info->passwd = NULL;
  }
  if (info->nonce)
  {
    free((void*)info->nonce);
    info->nonce = NULL;
  }
  if (info->opaque)
  {
    free((void*)info->opaque);
    info->opaque = NULL;
  }
  if (info->qop)
  {
    free((void*)info->qop);
    info->qop = NULL;
  }
  if (info->alg)
  {
    free((void*)info->alg);
    info->alg = NULL;
  }
}

/******************************************************************************/

/**
@brief Releases the digest store for proxy authentication and frees memory
@param soap context
@param info a pointer to the digest store
*/
SOAP_FMAC1
void
SOAP_FMAC2
http_da_proxy_release(struct soap *soap, struct http_da_info *info)
{
  soap->proxy_userid = NULL;
  soap->proxy_passwd = NULL;

  http_da_release(soap, info);
}

/******************************************************************************\
 *
 *      Server-side digest authentication verification
 *
\******************************************************************************/

/**
@brief Verifies the password credentials at the server side when used in an HTTP POST service operation.
@param soap context
@param passwd the user password string
@return SOAP_OK or error when verification failed
*/
SOAP_FMAC1
int
SOAP_FMAC2
http_da_verify_post(struct soap *soap, const char *passwd)
{
  return http_da_verify_method(soap, "POST", passwd);
}

/******************************************************************************/

/**
@brief Verifies the password credentials at the server side when used in an HTTP GET service operation.
@param soap context
@param passwd the user password string
@return SOAP_OK or error when verification failed
*/
SOAP_FMAC1
int
SOAP_FMAC2
http_da_verify_get(struct soap *soap, const char *passwd)
{
  return http_da_verify_method(soap, "GET", passwd);
}

/******************************************************************************/

static int
http_da_verify_method(struct soap *soap, const char *method, const char *passwd)
{
  struct http_da_data *data = (struct http_da_data*)soap_lookup_plugin(soap, http_da_id);
  char HA1hex[65], entityHAhex[65], response[65], responseHA[32];
  size_t smd_len = 16;

  if (!data)
    return SOAP_ERR;

  if (data->alg && !soap_tag_cmp(data->alg, "SHA-256*"))
    smd_len = 32;

  /* reject if none or basic authentication was used */
  if (!soap->authrealm
   || !soap->userid
   || soap->passwd)     /* passwd is set when basic auth is used */
    return SOAP_ERR;

  /* require at least qop="auth" to prevent replay attacks */
  if (!data->qop)
    return SOAP_ERR;

  if (http_da_session_update(soap->authrealm, data->nonce, data->opaque, data->cnonce, data->ncount))
    return SOAP_ERR;

  if (http_da_calc_HA1(soap, &data->smd_data, data->alg, soap->userid, soap->authrealm, passwd, data->nonce, data->cnonce, HA1hex))
    return soap->error;

  if (!soap_tag_cmp(data->qop, "auth-int"))
    (void)soap_s2hex(soap, (unsigned char*)data->digest, entityHAhex, smd_len);

  if (http_da_calc_response(soap, &data->smd_data, data->alg, HA1hex, data->nonce, data->ncount, data->cnonce, data->qop, method, soap->path, entityHAhex, response, responseHA))
    return soap->error;

  /* check digest response values */
  if (memcmp(data->response, responseHA, smd_len))
    return SOAP_ERR;

  return SOAP_OK;
}

/******************************************************************************\
 *
 *      Digest authentication session database management
 *
\******************************************************************************/

static void
http_da_session_start(const char *realm, const char *nonce, const char *opaque)
{
  struct http_da_session *session;
  time_t now = time(NULL);

  if (now % 10 == 0) /* don't do this all the time to improve efficiency */
    http_da_session_cleanup();

#ifdef SOAP_DEBUG
  fprintf(stderr, "Starting session realm=%s nonce=%s\n", realm, nonce);
#endif

  MUTEX_LOCK(http_da_session_lock);

  session = (struct http_da_session*)malloc(sizeof(struct http_da_session));
  if (session)
  {
    session->next = http_da_session;
    session->modified = now;
    session->realm = soap_strdup(NULL, realm);
    session->nonce = soap_strdup(NULL, nonce);
    session->opaque = soap_strdup(NULL, opaque);
    session->nc = 0;
    http_da_session = session;
  }

  MUTEX_UNLOCK(http_da_session_lock);
}

/******************************************************************************/

static int
http_da_session_update(const char *realm, const char *nonce, const char *opaque, const char *cnonce, const char *ncount)
{
  struct http_da_session *session;

  if (!realm || !nonce || !opaque || !cnonce || !ncount)
  {
#ifdef SOAP_DEBUG
    fprintf(stderr, "Debug message: authentication update failed, missing authentication data\n");
#endif
    return SOAP_ERR;
  }
#ifdef SOAP_DEBUG
  fprintf(stderr, "Debug message: updating session realm=%s nonce=%s\n", realm, nonce);
#endif

  MUTEX_LOCK(http_da_session_lock);

  for (session = http_da_session; session; session = session->next)
    if (!strcmp(session->realm, realm) && !strcmp(session->nonce, nonce) && !strcmp(session->opaque, opaque))
      break;

  if (session)
  {
    unsigned long nc = soap_strtoul(ncount, NULL, 16);

    if (session->nc >= nc)
    {
      session->modified = 0; /* replay attack: terminate session */
      session = NULL;
    }
    else
    {
      session->nc = nc;
      session->modified = time(NULL);
    }
  }

  MUTEX_UNLOCK(http_da_session_lock);

  if (!session)
    return SOAP_ERR;

  return SOAP_OK;
}

/******************************************************************************/

static void
http_da_session_cleanup()
{
  struct http_da_session **session;
  time_t now = time(NULL);

  MUTEX_LOCK(http_da_session_lock);

  session = &http_da_session;
  while (*session)
  {
    if ((*session)->modified + HTTP_DA_SESSION_TIMEOUT < now)
    {
      struct http_da_session *p = *session;

#ifdef SOAP_DEBUG
      fprintf(stderr, "Deleting session realm=%s nonce=%s\n", p->realm, p->nonce);
#endif

      if (p->realm)
        free((void*)p->realm);
      if (p->nonce)
        free((void*)p->nonce);
      if (p->opaque)
        free((void*)p->opaque);

      *session = p->next;
      free((void*)p);
    }
    else
      session = &(*session)->next;
  }

  MUTEX_UNLOCK(http_da_session_lock);
}

/******************************************************************************\
 *
 *      Calculate hex nonce and opaque values
 *
\******************************************************************************/

static void
http_da_calc_nonce(struct soap *soap, char nonce[HTTP_DA_NONCELEN])
{
  static short count = 0xCA53;
  (void)soap;
  (SOAP_SNPRINTF(nonce, HTTP_DA_NONCELEN, 20), "%8.8x%4.4hx%8.8x", (int)time(NULL), count++, soap_random);
}

/******************************************************************************/

static void
http_da_calc_opaque(struct soap *soap, char opaque[HTTP_DA_OPAQUELEN])
{
  (void)soap;
  (SOAP_SNPRINTF(opaque, HTTP_DA_OPAQUELEN, 8), "%8.8x", soap_random);
}

/******************************************************************************\
 *
 *      Calculate HA1, HA2, and response digest as per RFC2617 and RFC7617
 *
\******************************************************************************/

static int
http_da_calc_HA1(struct soap *soap, struct soap_smd_data *smd_data, const char *alg, const char *userid, const char *realm, const char *passwd, const char *nonce, const char *cnonce, char HA1hex[65])
{
  int smd_alg = SOAP_SMD_DGST_MD5;
  size_t smd_len = 16;
  char HA1[32];

  if (alg && !soap_tag_cmp(alg, "SHA-256*"))
  {
    smd_alg = SOAP_SMD_DGST_SHA256;
    smd_len = 32;
  }

  if (soap_smd_init(soap, smd_data, smd_alg, NULL, 0)
   || soap_smd_update(soap, smd_data, userid, strlen(userid))
   || soap_smd_update(soap, smd_data, ":", 1)
   || soap_smd_update(soap, smd_data, realm, strlen(realm))
   || soap_smd_update(soap, smd_data, ":", 1)
   || soap_smd_update(soap, smd_data, passwd, strlen(passwd))
   || soap_smd_final(soap, smd_data, HA1, NULL))
    return soap->error;

  if (alg && !soap_tag_cmp(alg, "*-sess"))
  {
    if (soap_smd_init(soap, smd_data, smd_alg, NULL, 0)
     || soap_smd_update(soap, smd_data, HA1, smd_len))
      return soap->error;

    if (nonce)
    {
      if (soap_smd_update(soap, smd_data, ":", 1)
       || soap_smd_update(soap, smd_data, nonce, strlen(nonce)))
        return soap->error;
    }

    if (soap_smd_update(soap, smd_data, ":", 1)
     || soap_smd_update(soap, smd_data, cnonce, strlen(cnonce))
     || soap_smd_final(soap, smd_data, HA1, NULL))
      return soap->error;
  }

  (void)soap_s2hex(soap, (unsigned char*)HA1, HA1hex, smd_len);

  return SOAP_OK;
};

/******************************************************************************/

static int
http_da_calc_response(struct soap *soap, struct soap_smd_data *smd_data, const char *alg, char HA1hex[65], const char *nonce, const char *ncount, const char *cnonce, const char *qop, const char *method, const char *uri, char entityHAhex[65], char response[65], char responseHA[32])
{
  int smd_alg = SOAP_SMD_DGST_MD5;
  size_t smd_len = 16;
  char HA2[32], HA2hex[65];

  if (alg && !soap_tag_cmp(alg, "SHA-256*"))
  {
    smd_alg = SOAP_SMD_DGST_SHA256;
    smd_len = 32;
  }

  if (soap_smd_init(soap, smd_data, smd_alg, NULL, 0)
   || soap_smd_update(soap, smd_data, method, strlen(method))
   || soap_smd_update(soap, smd_data, ":", 1)
   || soap_smd_update(soap, smd_data, uri, strlen(uri)))
    return soap->error;

  if (qop && !soap_tag_cmp(qop, "auth-int"))
  {
    if (soap_smd_update(soap, smd_data, ":", 1)
     || soap_smd_update(soap, smd_data, entityHAhex, 2*smd_len))
      return soap->error;
  }

  if (soap_smd_final(soap, smd_data, HA2, NULL))
    return soap->error;

  (void)soap_s2hex(soap, (unsigned char*)HA2, HA2hex, smd_len);

  if (soap_smd_init(soap, smd_data, smd_alg, NULL, 0)
   || soap_smd_update(soap, smd_data, HA1hex, 2*smd_len))
    return soap->error;

  if (nonce)
  {
    if (soap_smd_update(soap, smd_data, ":", 1)
     || soap_smd_update(soap, smd_data, nonce, strlen(nonce)))
      return soap->error;
  }

  if (qop && *qop)
  {
    if (soap_smd_update(soap, smd_data, ":", 1)
     || soap_smd_update(soap, smd_data, ncount, strlen(ncount))
     || soap_smd_update(soap, smd_data, ":", 1)
     || soap_smd_update(soap, smd_data, cnonce, strlen(cnonce))
     || soap_smd_update(soap, smd_data, ":", 1)
     || soap_smd_update(soap, smd_data, qop, strlen(qop)))
      return soap->error;
  }

  if (soap_smd_update(soap, smd_data, ":", 1)
   || soap_smd_update(soap, smd_data, HA2hex, 2*smd_len)
   || soap_smd_final(soap, smd_data, responseHA, NULL))
    return soap->error;

  (void)soap_s2hex(soap, (unsigned char*)responseHA, response, smd_len);

  return SOAP_OK;
}

/******************************************************************************/

#ifdef __cplusplus
}
#endif